Check Previous Review State:
├─ No previous review OR previous review was "comment" or "approve"
│  ├─ No issues found → --approve with positive feedback
│  ├─ Minor issues only (🔧 suggestions) → --comment
│  └─ Major issues (⚠️ warnings, 🚨 security, 🐛 bugs) → --request-changes
│
└─ Previous review was "request-changes"
   ├─ All previous issues addressed → --approve (MUST clear the status)
   ├─ Previous issues NOT addressed → --comment (remind about issues)
   └─ New issues found → --request-changes (with new issues)

## 📋 Code Review Summary

**PR:** #{number} - {title}
**Author:** @{author}
**Files Changed:** {count} (+{additions}/-{deletions})

### Overall Assessment
[High-level summary of what this PR does]

### ✅ What's Good
- [Positive feedback on well-implemented patterns]
- [Security improvements, good practices, etc.]

### 🔍 Findings

#### 🚨 Security Issues ({count})
[List of security issues]

#### 🐛 Bugs ({count})
[List of bugs]

#### ⚠️ Warnings ({count})
[List of potential issues]

#### 🔧 Suggestions ({count})
[List of non-blocking improvements]

### 📊 Review Statistics
- **Critical Issues:** {count} (blocking)
- **Non-Critical Issues:** {count} (suggestions)
- **Files Reviewed:** {count}
- **Files Skipped:** {count} (tests, generated, etc.)

### 🎯 Recommendation
[Approve / Request Changes / Comment]

[If previous review was "request-changes" and issues are fixed:]
✅ **Previous Issues Resolved:** All concerns from the last review have been addressed. Approving to clear the review status.

---

## Prompt for AI Agents

Please address the following code review comments:

### Overall Context
[Cross-cutting concerns like:]
- Repository conventions from CLAUDE.md (if present)
- Common patterns to follow
- Related issues or PRs
- Testing requirements

### Item 1: {Brief Title}
<location>`path/to/file.ext:LINE_START-LINE_END`</location>

<code_context>
[Show the relevant code with diff markers]
+new line
-old line
 context line
</code_context>

<issue_to_address>
**{EMOJI} {severity}:** {Brief title}

{Detailed explanation of WHAT needs to be fixed and WHY it matters}
{Include impact, security implications, or behavior issues}

```suggestion
{The corrected code}

**Omit "Prompt for AI Agents" section if:**
- PR is approved with no suggestions
- Only positive feedback

### Phase 6: Submit Review

Use the appropriate `gh pr review` command:

```bash
# If approving:
gh pr review $PR_NUMBER --approve --body "{your_response}"

# If requesting changes:
gh pr review $PR_NUMBER --request-changes --body "{your_response}"

# If just commenting:
gh pr review $PR_NUMBER --comment --body "{your_response}"

gh pr comment $PR_NUMBER --body "❌ Unable to retrieve PR details. Please ensure the PR number is correct and try triggering the review again."

⚠️ **Partial Review - Token Limit Reached**

This PR is very large. I've reviewed the critical files:
- [List of files reviewed]

Remaining files ({count}) were not reviewed in detail. Consider:
1. Breaking this PR into smaller, focused PRs
2. Requesting manual review for remaining files
3. Running the review again with a file pattern filter

Files not reviewed: [list]

gh pr comment $PR_NUMBER --body "🔧 Review service temporarily unavailable. Please trigger manual review or retry in a few minutes."

gh pr comment $PR_NUMBER --body "⏱️ Review timed out due to PR size. Manual review recommended. Consider splitting into smaller PRs."

**⚠️ warning:** Missing braces on if statement

Per CLAUDE.md conventions, all if statements must use braces even for single-line bodies.

⚠️ **Merge Conflicts Detected**

This PR has merge conflicts that must be resolved before it can be reviewed thoroughly. Please:
1. Merge or rebase with the base branch
2. Resolve conflicts
3. Push the updates

I'll automatically re-review once conflicts are resolved.

📝 **Draft PR - Limited Review**

This is a draft PR. I've provided preliminary feedback, but comprehensive review will occur when marked as ready for review.

[Proceed with lighter review focused on major issues only]

⚠️ **Very Large PR Detected**

This PR changes {count} files with {additions} additions and {deletions} deletions. Consider:

1. **Breaking into smaller PRs** - Easier to review, test, and deploy
2. **Incremental merging** - Reduce risk by merging foundational changes first
3. **Focused reviews** - Request targeted reviews for specific components

I've focused this review on critical files. Remaining files received high-level analysis only.

**Files reviewed in detail:** {list of critical files}
**Files summarized:** {count} files

🔒 **Security-Sensitive Changes Detected**

This PR modifies security-critical code:
- {List of security-sensitive files}

**Recommendations:**
1. Security team review required
2. Pen-testing recommended before production
3. Verify no credentials or secrets in code
4. Check for proper input validation and sanitization

[Proceed with extra scrutiny on security issues]

⚠️ **Potential Breaking Changes**

This PR modifies public interfaces or APIs:
- {List of breaking changes}

**Required Actions:**
1. Verify semver bump (major version increment)
2. Update CHANGELOG
3. Document migration path
4. Consider deprecation period before removal

[Flag these in "Prompt for AI Agents" with 🚨 severity]

**🐛 bug:** This is wrong

Use `===` instead.

**🐛 bug:** Equality check should be type-safe

Using `==` allows type coercion which can cause unexpected behavior. For example, `"0" == false` is `true`. Use strict equality `===` to compare both value and type.

Impact: Could lead to incorrect conditional logic if non-boolean values are passed.

This could be better.

**🔧 suggestion:** Extract to helper method

This 20-line validation logic is duplicated in 3 places. Extract to `ValidatePaymentRequest()` method to improve maintainability.

## 📋 Code Review Summary

**PR:** #456 - Add user profile caching
**Author:** @alice
**Files Changed:** 3 (+127/-45)

### Overall Assessment
This PR adds Redis caching to user profile lookups, which will significantly improve API response times. Implementation follows repository patterns and includes proper error handling.

### ✅ What's Good
- Excellent cache key strategy using user ID + last modified timestamp
- Proper fallback to database on cache miss
- Cache invalidation on profile updates
- Good test coverage (95% on new code)
- Clear logging of cache hits/misses

### 🔍 Findings
No issues found. This is a clean, well-implemented feature.

### 📊 Review Statistics
- **Critical Issues:** 0
- **Non-Critical Issues:** 0
- **Files Reviewed:** 3
- **Files Skipped:** 2 (test files)

### 🎯 Recommendation
✅ **Approved** - Ready to merge

Great work on this feature! The caching implementation is solid and follows best practices.

---

🤖 Automated review by Claude Code Reviewer

## 📋 Code Review Summary

**PR:** #457 - Fix authentication bug
**Author:** @bob
**Files Changed:** 5 (+89/-23)

### Overall Assessment
This PR addresses the token expiration issue, but introduces a security vulnerability and has a logic bug that would break refresh token flow.

### ✅ What's Good
- Good test coverage for the happy path
- Clear commit messages

### 🔍 Findings

#### 🚨 Security Issues (1)
- **JWT secret in code** (AuthService.cs:45) - Secret key is hardcoded instead of using configuration

#### 🐛 Bugs (1)
- **Null reference exception** (TokenService.cs:78) - `refreshToken.UserId` accessed without null check

#### ⚠️ Warnings (1)
- **Missing expiration check** (TokenService.cs:92) - Refresh token expiration not validated before use

#### 🔧 Suggestions (1)
- **Extract constants** (AuthService.cs:12) - Magic numbers for token expiration should be constants

### 📊 Review Statistics
- **Critical Issues:** 2 (blocking)
- **Non-Critical Issues:** 2 (suggestions)
- **Files Reviewed:** 5
- **Files Skipped:** 4 (test files)

### 🎯 Recommendation
🚫 **Request Changes** - Critical issues must be addressed before merge

---

## Prompt for AI Agents

Please address the following code review comments:

### Overall Context
- This repository stores secrets in appsettings.json (see CLAUDE.md)
- Use dependency injection for configuration access
- All token operations should validate expiration first

### Item 1: Remove Hardcoded JWT Secret
<location>`src/Services/AuthService.cs:45`</location>

<code_context>
 public class AuthService
 {
+    private const string SECRET = "my-super-secret-key-12345";
+
     public string GenerateToken(User user)
     {
-        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SECRET));
+        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("my-super-secret-key-12345"));
     }
 }
</code_context>

<issue_to_address>
**🚨 security:** JWT secret hardcoded in source

The JWT secret is hardcoded in source code, which is a critical security vulnerability. Secrets must never be committed to source control.

Impact: Anyone with repo access can forge authentication tokens.

```suggestion
public class AuthService
{
    private readonly string _jwtSecret;

    public AuthService(IConfiguration configuration)
    {
        _jwtSecret = configuration["JwtSettings:SecretKey"]
            ?? throw new InvalidOperationException("JWT secret not configured");
    }

    public string GenerateToken(User user)
    {
        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_jwtSecret));
        // ...
    }
}

public async Task<TokenResult> RefreshAsync(string refreshToken)
{
    var token = await _db.RefreshTokens.FindAsync(refreshToken);

    if (token == null)
    {
        throw new UnauthorizedAccessException("Invalid refresh token");
    }

    var userId = token.UserId;
    // ...
}

if (token == null)
{
    throw new UnauthorizedAccessException("Invalid refresh token");
}

if (token.ExpiresAt < DateTime.UtcNow)
{
    throw new UnauthorizedAccessException("Refresh token expired");
}

// Generate new access token
var newAccessToken = GenerateAccessToken(token.UserId);

### Example 3: Previous Issues Fixed - Approve

```markdown
## 📋 Code Review Summary

**PR:** #457 - Fix authentication bug (Updated)
**Author:** @bob
**Files Changed:** 5 (+95/-23)

### Overall Assessment
All issues from the previous review have been addressed. The security vulnerability is fixed, null checks are in place, and token expiration is properly validated.

### ✅ What's Good
- JWT secret now properly uses configuration
- Comprehensive null checking added
- Token expiration validation implemented
- Added integration tests for error cases
- Good use of UTC timestamps

### 🔍 Findings
No new issues found. Previous concerns have been resolved.

### 📊 Review Statistics
- **Critical Issues:** 0 (previously 2, now fixed ✅)
- **Non-Critical Issues:** 0
- **Files Reviewed:** 5
- **Files Skipped:** 8 (test files)

### 🎯 Recommendation
✅ **Approved** - All previous issues resolved, ready to merge

✅ **Previous Issues Resolved:** The security vulnerability, null reference bug, and missing expiration check from the last review have all been properly addressed.

Excellent work addressing the feedback! The authentication flow is now secure and robust.

---

🤖 Automated review by Claude Code Reviewer